Organization based webresources

[Alf21]

A short time ago, we received the possibility to work with WebSockets, so we are able fetching data asynchronously, giving the player the possibility e.g. to interact with the game longer than one session too.

I thought about a system where you can fetch player-based data that shouldn't be server- or session- restricted nor clientside-saved, for example an achievement system. But every other system that could need an interaction with webresources needs this as well: A possibility to connect to a webservice securely.

Why does it not work currently:
Currently, you download the whole add-on as client, so you can such search in the files for the webservice login keys. Or if projects are community hosted, you can simply search them on GitHub. If you have access to the not very "secured" key, you can modify databased at your wishes.

How should that stuff be handled imo:
It would be cool if we had a organization based possibility to add environment vars that are used inside server-sided functions to connect to a websocket. The server shouldn't be able to fetch environment vars directly as that would give server-owners the possibility to receive an org-based secured key. Accordingly, a function that would send a message to a org-based proxy (which inserts the org-based key (if the message was send from a valid server) and sends the server-sended data to a org-based webresource) would handle that issue.

I know that's a lot of networking stuff and definitely not needed currently, but would be a cool feature in the upcoming time to add achievements and keep people long-time playing, server-independently. Maybe there are better ideas, just putting my 2 neurons together.

What do you think? 😄

[garrynewman]

What are you asking for?

[Alf21]

TL;DR:
A possibility to sync (store&fetch) gamemode data server-/lobby-independently and savely (not clientside or serverside saved, but organization-based).

[Rohansi]

@Alf21 I think it'd be better to describe this with a few use cases instead of how you might accomplish it. You mentioned achievements as one so could you elaborate on that use case and add others?

[Rohansi]

1. Achievements/unlocks - might make more sense to have these built-in as something S&box provides rather than everyone rolling their own
2. Ban system - doesn't really apply to anything except dedicated servers, which should be able to connect to databases etc directly (dedicated server support is todo)
3. Player status system - same as above?

[Alf21]

Exactly.

Achievements/unlocks - might make more sense to have these built-in as something S&box provides rather than everyone rolling their own
Ban system - doesn't really apply to anything except dedicated servers, which should be able to connect to databases etc directly (dedicated server support is todo)

And how to connect to such a database securely? ;)

[Rohansi]

We haven't gotten to dedicated server scenarios like that yet. We'll get there eventually but for now just assume there will be a way in the future.

[R4K0]

External service connectivity isn't just needed for dedicated server scenarios - There needs to be a safe environment in which we can communicate with external services with the assumption that average client cannot get that key.

As general use-case examples: Gamemode that might generate story data using GTP-3 HTTP API which is behind authentication gate. What about other public services - What if I want to make a trivia gamemode that retrieves the trivia questions off a public web service? 911 operator-simulator that uses Google Maps API? I don't want my API keys to be abused, and all the possible use cases for this warrant it being looked into sooner than we get dedicated servers, imo.

(disregard below, didn't read OP post fully and he came up with an identical idea - Leaving it for clarity.)

Something like environment variables that we define on the dev portal that are injected only on the server-side on lobby instance creation would be neat.

There's still the question of malicious server owner actors scraping of that API key, but at this point you've reduced the risk to minimum.

Perhaps even an interaction layer between the game addon code -> Facepunch dev server -> external API service, so this way the game lobby requests the FP API middle-man to interact with our predefined API service, this way the game/addon code never gets the API key.

[Rohansi]

The layer between the game and the API is a valid approach. However, how would an FP API solve this? We know nothing about the APIs you want to connect to so realistically you'd need to write code to run on our web servers... turning us into a hosting provider. I don't see this happening.

If you absolutely need things to work this way then I think the right way would be to host your own API middle-man which accepts S&box authentication of some sort and issues secure API requests on behalf of the player.

Dedicated servers are a totally different case because it would be a scenario where you can trust the server and not need a separate API middle-man.